This is a common and over-zealous implementation of GDPR tracking compliance. Lots of people have lost lots of data, by going slightly overboard in a similar way. Basically you have taken GDPR compliance too far!
GDPR is supposed to protect the user's data, but in terms of - is there a 1 or a 0 in a box in an SQL database for whether an anonymous user visited your site or not (traffic data, not belonging to the user) - it's actually fine to track that (in most instances) without consent. Why? Because the data cannot be used to identify the user, ergo it's your website data and not the user's user data
There used to be a GA hack which Google patched, which forced GA to render IP addresses - but even before it was patched, they banned people (who were using the exploit) from GA for breaking ToS. That kind of data (PII / PID), unless you have specifically set something up through event tracking that records sensitive stuff - just shouldn't even be in Google Analytics at all (and if you do have data like that in your GA, you may be breaking Google's ToS depending upon deployment)
If the data which you will be storing (data controller rules apply) or sending to a 3rd party to store (in which case you are only the data processor and they are the data controller) does not contain PID (personally identifiable data - e.g: email addresses, physical addresses, first and last names, phone numbers etc) - then it's not really covered by GDPR. If you can say that these users have an interest in your business and show that a portion of them transact regularly, you're even less at risk of breaking GDPR compliance
If you're worried about cookie stuff:
"Note: gtag.js and analytics.js do not require setting cookies to transmit data to Google Analytics."
It's possible with some advanced features switched on like re-marketing related stuff, this might change. But by default at least, it seems as if Google themselves are saying that the transmission of data and the deploying of any cookies are not related to each other, and that without cookies the later scripts can send data to GA just fine without cookies
If you are not tracking basic, page-view level data which is not the user's data (which is not PII / PID), then you are over-applying GDPR. The reason there aren't loads of people moaning about this problem, is that it's only a problem for the minority of people who have accidentally over-applied GDPR compliance. As such it's not a problem for others, so there's no outcry
There'**s lots more info here: **https://www.blastam.com/blog/gdpr-need-consent-for-google-analytics-tracking
"This direction is quite clear. If you have enabled Advertising features in Google Analytics, then you need consent from the EU citizen first. Google defines ‘Advertising features’ as:
- Remarketing with Google Analytics.
- Google Display Network Impression Reporting.
- Google Analytics Demographics and Interest Reporting.
- Integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers.
-"
If you aren't using most, many or any of the advanced advertising features, your implementation is likely to be way too aggressive. Even if you are using those advanced features, you only need consent for those elements and specifically where they apply and transmit data. A broad-brush ban on transmitting all GA data is thoroughly overkill
Think about proposing a more granular, more detailed approach. Yes it will likely need some custom dev time to get it right and it could be costly, but the benefit is not throwing away all your future data for absolutely no reason at all
Don't forget that, as the data 'storer' (controller), a lot of the burden is actually on Google's side
**Read more here: **https://privacy.google.com/businesses/compliance/#!?modal_active=none
Hope this helps